9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9

General

Target

9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
Size

58KB
MD5

090826f8c220f419048046403441984e
SHA1

cc9e473e7e5ab6ebbdafe1cbfc376cbb866ba8fe
SHA256

9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9
SHA512

a361baf6e0761ee0004a0ef08983816e79923fa3aa08d5080910f1ca14049786ac59084c38e80fe91c68688efd0c877927bdd7644c7176b6824cbb7fee7c19ca
SSDEEP

768:CsboeblozOtvdnHmw8g1bC3gXNii8fyQzVO6wcMrIXI42yqNB44/ZGjeuF5wn57D:93t1+QR8f/hOOjXD2/RhZuF5HcCVes6

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Beep.sys	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Beep.sys	vmdetdhc.exe

Executes dropped EXE 1 IoCs

pid	Process
364	vmdetdhc.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1636-55-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0009000000012310-56.dat	upx
behavioral1/memory/1636-57-0x0000000000480000-0x00000000004B3000-memory.dmp	upx
behavioral1/files/0x0009000000012310-58.dat	upx
behavioral1/files/0x0009000000012310-60.dat	upx
behavioral1/files/0x0009000000012310-63.dat	upx
behavioral1/memory/364-65-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1636-67-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1540	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vmdetdhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vmdetdhc.exe = "C:\\Windows\\system32\\vmdetdhc.exe"	vmdetdhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vmdetdhc.exe = "C:\\Windows\\system32\\vmdetdhc.exe"	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vmdetdhc.exe	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
File created	C:\Windows\SysWOW64\vmdetdhc.exe	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
File opened for modification	C:\Windows\SysWOW64\vmdetdhc.exe	vmdetdhc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
File created	C:\Windows\ResetTest.txt	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
364	vmdetdhc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 364	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	30
PID 1636 wrote to memory of 364	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	30
PID 1636 wrote to memory of 364	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	30
PID 1636 wrote to memory of 364	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	30
PID 364 wrote to memory of 1420	364	vmdetdhc.exe	31
PID 364 wrote to memory of 1420	364	vmdetdhc.exe	31
PID 364 wrote to memory of 1420	364	vmdetdhc.exe	31
PID 364 wrote to memory of 1420	364	vmdetdhc.exe	31
PID 1636 wrote to memory of 1540	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	33
PID 1636 wrote to memory of 1540	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	33
PID 1636 wrote to memory of 1540	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	33
PID 1636 wrote to memory of 1540	1636	9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe	33

C:\Users\Admin\AppData\Local\Temp\9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe
"C:\Users\Admin\AppData\Local\Temp\9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\vmdetdhc.exe
  C:\Windows\system32\vmdetdhc.exe -Start
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c erase /F /A "C:\Windows\SysWOW64\vmdetdhc.exe" > nul
    3⤵
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F /A "C:\Users\Admin\AppData\Local\Temp\9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9.exe" > nul
  2⤵
  - Deletes itself
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\Beep.sys

Filesize
13KB

MD5
2c3482aa3bf0a80b04d1ae28432d508a

SHA1
b13c9a85e5d09438e9f201f3ea0a94b7b087c6a3

SHA256
e31f235499693b0a217e47426f591d4c946453a5db918ba7727159b4cae992ce

SHA512
1de92c90b7c8aa049dc8eece40363aef214830cf24c5e83ae33253d10c071a3ea68b7e6f7832743c5de177cdfb5843c2dd3dd78dae5c3cffdec3b42203921ea9

Download Submit
C:\Windows\SysWOW64\vmdetdhc.exe

Filesize
58KB

MD5
090826f8c220f419048046403441984e

SHA1
cc9e473e7e5ab6ebbdafe1cbfc376cbb866ba8fe

SHA256
9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9

SHA512
a361baf6e0761ee0004a0ef08983816e79923fa3aa08d5080910f1ca14049786ac59084c38e80fe91c68688efd0c877927bdd7644c7176b6824cbb7fee7c19ca

Download Submit
C:\Windows\SysWOW64\vmdetdhc.exe

Filesize
58KB

MD5
090826f8c220f419048046403441984e

SHA1
cc9e473e7e5ab6ebbdafe1cbfc376cbb866ba8fe

SHA256
9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9

SHA512
a361baf6e0761ee0004a0ef08983816e79923fa3aa08d5080910f1ca14049786ac59084c38e80fe91c68688efd0c877927bdd7644c7176b6824cbb7fee7c19ca

Download Submit
C:\Windows\win.ini

Filesize
499B

MD5
efa6d048d7f1724b9b1e143f3cfe04b4

SHA1
33876af5e48c482e95e341c04e91d1618f621d8b

SHA256
00dd20839e72a2adc7f07b912702eb1b2152e74eb7fa426f3b0e5cb937532e39

SHA512
e6fb5a1cca7bdca672475ba949a2e0f258724c9307a0f2e5171669af126f2dd2e1d63041776f3dcb15264a82773852708797e728c7485934a078899da773f335

Download Submit
\Windows\SysWOW64\vmdetdhc.exe

Filesize
58KB

MD5
090826f8c220f419048046403441984e

SHA1
cc9e473e7e5ab6ebbdafe1cbfc376cbb866ba8fe

SHA256
9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9

SHA512
a361baf6e0761ee0004a0ef08983816e79923fa3aa08d5080910f1ca14049786ac59084c38e80fe91c68688efd0c877927bdd7644c7176b6824cbb7fee7c19ca

Download Submit
\Windows\SysWOW64\vmdetdhc.exe

Filesize
58KB

MD5
090826f8c220f419048046403441984e

SHA1
cc9e473e7e5ab6ebbdafe1cbfc376cbb866ba8fe

SHA256
9c5b23a03255546ceaac46c3e4b5dbf362bd312c3eaa7e31186ef8a4fe2271e9

SHA512
a361baf6e0761ee0004a0ef08983816e79923fa3aa08d5080910f1ca14049786ac59084c38e80fe91c68688efd0c877927bdd7644c7176b6824cbb7fee7c19ca

Download Submit
memory/364-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1636-57-0x0000000000480000-0x00000000004B3000-memory.dmp

Filesize
204KB

Download
memory/1636-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing